Remember why your code is the way it is.

The problem

Everyone has this story: someone new opens a file, finds code that looks redundant, cleans it up, and takes production down. The mess was load-bearing — written that way after an incident, and the reason was never recorded anywhere they'd look.

That used to happen occasionally, at human speed. Now every team has an infinitely fast engineer with total amnesia. Coding agents write a large share of merged code, and they do the same thing many times a day.

What it does

$ whence src/auth/session.go:142

  ● 2026-07-27 · code-review · confidence 0.94
    Don't write shared session keys from this flow.
    "userToken", "userId" and "role" are all read by the
    admin dashboard — same origin, same app. Writing them
    here signs a staff user out mid-session.
    → namespace all three
    anchored via content-hash · source: code-review log

The same record reaches your agent through MCP before it edits, so the fix doesn't get undone. And it holds the line in CI:

$ whence check --base origin/main

  ✗ src/auth/session.go:145
    writes localStorage["role"] — contradicts record #4f2a
    "namespace all three keys" (2026-07-27)

  1 violation. exit 1

How it works

1. Capture. Hooks into your coding agent and records the decision trail as the session runs. Redaction happens here, before anything is written to disk.
2. Anchor. Binds each record to a line range, a content hash and an AST path — so it survives reformatting, drift and most refactors. When confidence decays too far, the record is surfaced as orphaned rather than quietly pointing at the wrong line.
3. Surface. From your terminal, to your agent over MCP, and as a gate in CI.

What it isn't

• Not a code reviewer. It produces zero opinions about code quality. Different job, well-served category.
• Not an observability platform. No traces, no evals, no token dashboards.
• Not a knowledge graph. It answers one question about one line.

Built with care about

Records store hashes, paths and ranges — never your file contents by default. Redaction runs at capture, not at write. The store refuses to run if it's git-tracked. Records are signed, and treated as data rather than instructions, because anything feeding an agent's context is a prompt-injection target.

Attribution is aggregate-only by default. No per-developer AI-authorship leaderboards. This is a developer tool and it will not become a surveillance tool.